MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e9a9281cb037d23802b397e92d216c429ff67a9871602f57f58c7b17f132d6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e9a9281cb037d23802b397e92d216c429ff67a9871602f57f58c7b17f132d6e
SHA3-384 hash: a60ac60a46cdd63d21d4e8c14497f82be5fd7fe073d100bb21089ccde04a5f72f86332d67d0937c547273c33f5710547
SHA1 hash: 14250b10795a65ae1afa81865eb9634f5564a6a1
MD5 hash: a6ea0fc5a75df6c69541cce9d763b062
humanhash: kilo-low-low-low
File name:Proforma Invoice.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:591'266 bytes
First seen:2020-10-30 15:54:21 UTC
Last seen:2020-10-30 16:27:19 UTC
File type: gz
MIME type:application/x-rar
ssdeep 12288:0G1i61MxgqCjlLpUkGQ0gLKvKgPkpfCvd5MhyWBB7fkt79/:0qX1MbChh4gLy1IfhLBBLkp9/
TLSH 34C423BCE4E89FF5371541372B6784CD8641E6318B2E449DF23AE55A1C9A0C7E0B78B2
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
4
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27502.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e9a9281cb037d23802b397e92d216c429ff67a9871602f57f58c7b17f132d6e/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-10-30 15:34:36 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n2njfaolan6shablhf7jfuqwyqu76z5jq4laf5l7ldd3c7ytfvxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6e9a9281cb037d23802b397e92d216c429ff67a9871602f57f58c7b17f132d6e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 6e9a9281cb037d23802b397e92d216c429ff67a9871602f57f58c7b17f132d6e

(this sample)

AgentTesla

Executable exe eda8bfc1dfcc087cb1e4033a5730953c3af823e6c3a4f16e7c72f1c7963bb683

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eda8bfc1dfcc087cb1e4033a5730953c3af823e6c3a4f16e7c72f1c7963bb683
  
Dropping
MD5 052b1fe5acb1765cb24cc561fa08339c

Comments